PT-2008-4215 · Dt · Dt Centrepiece

Published 2008-06-19 · Updated 2017-08-08 · CVE-2008-2775

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DT Centrepiece version 4.0

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. The issue is related to the searchFor parameter in the "search.asp" page.

Recommendations For DT Centrepiece version 4.0, consider restricting access to the search.asp page or validating and sanitizing the searchFor parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the searchFor parameter in the search.asp page until the issue is resolved.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-2775

Affected Products

Dt Centrepiece

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-2775 · Security Note
• http://secunia.com/advisories/30382 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42663 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2775 · Note
• http://securityfocus.com/bid/29403 · Note